General
- Target 2026-07-22_c8dae6feb7b52d225cefc5f3937f84e0_icedid_mespinoza_njrat_ryuk
- Size 1.9MB
- Sample260722-29357aam81
- SHA256 830f1980a0444a3de134c6d61ebf7f1eac66dbc7ebc5f4a344c03a8ff6bd39fa
- MD5 c8dae6feb7b52d225cefc5f3937f84e0
- SHA1 b1ebfeeb75e0325bf1605d03a5a9370e7bde037c
- SHA512 31e6ad4bcb143d5ed9e4fcd922f388c9ef212f5e8c5f082616891d71aab50cf3ebe15e09751cdf4a7e23723a67ad4e2e10cd74cab3ea2a2e2e56a21c3dc481ac
- SSDEEP 24576:/pr0GOF8lf/js0w48hXIsqjnhMgeiCl7G0nehbGZpbD:iGs8lf/jsR4kkDmg27RnWGj
- TLSH T17D95D05AF75448F5D1678138C552860BE3B27C581B61D7CB12A9E3AE2F335E08E3EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-22_c8dae6feb7b52d225cefc5f3937f84e0_icedid_mespinoza_njrat_ryuk.exe
Resource
win10v2004-20260513-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-22_c8dae6feb7b52d225cefc5f3937f84e0_icedid_mespinoza_njrat_ryuk.exe
Resource
win11ltsc2024-20260709-en
5 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-22_c8dae6feb7b52d225cefc5f3937f84e0_icedid_mespinoza_njrat_ryuk
- Size 1.9MB
- SHA256 830f1980a0444a3de134c6d61ebf7f1eac66dbc7ebc5f4a344c03a8ff6bd39fa
- MD5 c8dae6feb7b52d225cefc5f3937f84e0
- SHA1 b1ebfeeb75e0325bf1605d03a5a9370e7bde037c
- SHA512 31e6ad4bcb143d5ed9e4fcd922f388c9ef212f5e8c5f082616891d71aab50cf3ebe15e09751cdf4a7e23723a67ad4e2e10cd74cab3ea2a2e2e56a21c3dc481ac
- SSDEEP 24576:/pr0GOF8lf/js0w48hXIsqjnhMgeiCl7G0nehbGZpbD:iGs8lf/jsR4kkDmg27RnWGj
- TLSH T17D95D05AF75448F5D1678138C552860BE3B27C581B61D7CB12A9E3AE2F335E08E3EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Drops file in System32 directory